Fix ERROR_LOG_NOT_ENOUGH_CONTAINERS (0x000019EB)

If you're staring at ERROR_LOG_NOT_ENOUGH_CONTAINERS (0x000019EB), you're probably trying to read or write to a log file that's missing its second container. That's the whole deal — Windows won't touch a log with only one container. Let's fix it.

The Fix: Restart the Log Service or Adjust Container Count

There are two ways to go. Try the quick one first. If that doesn't cut it, we'll dig into the registry.

Fix 1: Restart the Windows Event Log Service

This forces the log to reinitialize with the correct container count.

1. Press Win + R, type services.msc, and hit Enter.
2. Scroll down to Windows Event Log. Right-click it and select Stop. Wait 10 seconds.
3. Right-click it again and select Start.
4. Now try whatever action gave you the error. If it's gone, you're done. You should be able to read or write to the log normally.

Fix 2: Manually Set the Container Count in the Registry

If restarting didn't work, the log's container count is probably stored wrong. Let's fix that directly.

1. Open Registry Editor: press Win + R, type regedit, and hit Enter. Click Yes if UAC asks.
2. Go to:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\LogFileName
   Replace LogFileName with the actual log file name you're having trouble with (like Application or System). If you're not sure, check the error message — it often names the log.
3. On the right side, look for a DWORD called ContainerCount. If it's missing or set to 1, that's your problem.
4. Right-click empty space, choose New > DWORD (32-bit) Value, name it ContainerCount. Set its value to 2 (decimal). That's the minimum. You can go higher — 4 or 8 is fine — but 2 is all you need.
5. Click OK and close Registry Editor.
6. Restart the Windows Event Log service (same steps as Fix 1). After restart, check if the error is gone.

Why This Happens

Windows uses a circular log structure with containers — think of them as buckets. Each bucket holds a chunk of log data. The system needs at least two buckets to rotate between: one to write to, one to read from. If you've got only one, it can't swap them safely. This usually happens after a bad shutdown, a disk full condition, or a corrupted registry write that reset the count to 1.

Less Common Variations

You might see this error with custom ETW (Event Tracing for Windows) sessions, not just the standard Event Log. For example, if you're using logman or a third-party tool that creates its own trace session, the same rule applies: the session needs at least two buffers (the ETW term for containers).

• Variation 1: The error shows in a command prompt after running logman start. Fix: stop the session, create it again with ?minimumBuffers=2 and ?maximumBuffers=2.
• Variation 2: You're using a performance monitoring tool like PerfMon. The trace log it created might have only one container. Delete the old trace file and let the tool recreate it.
• Variation 3: This happens in SQL Server's error log. SQL uses a similar container system. Check the SQL Server Configuration Manager and set the Number of log files to at least 2.

How to Prevent It

Prevention is boring but simple. Don't let your disk fill up — a full disk during a log write can corrupt the container count. Keep your system stable; avoid hard reboots. If you're paranoid, set the registry ContainerCount to 4 or higher. That gives you some buffer (pun intended) if one gets corrupted. Also, make sure your antivirus isn't locking the log files — I've seen aggressive AV software truncate them to single containers.

That's it. You shouldn't see 0x000019EB again unless something really bad happens. If you do, come back and bump the container count higher — sometimes a log just needs more buckets.